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We  have  been  developing  formal  methods  for  monitoring  safety-critical  real-time  and  reactive 
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statements  about  the  correctness  of  program  behavior  rather  than  of  the  program  itself. 

To  integrate  these  ideas  we  have  implemented  a  prototype  system  (JavaMAC)  for  monitoring  and 
checking  Java  programs.  MAC  takes  a  monitoring  script  provided  by  the  user,  the  program,  and  a  requirement 
specification  and  produces  a)  an  instrumentation  of  the  program  to  send  variable  update  information  to  the 
monitoring  and  checking  unit  b)  a  script  for  transforming  low  level  program  variable  values  to  abstract  events 
and  c)  a  script  for  checking  whether  a  .sequence  of  events  is  consistent  with  the  desired  property.  These  scripts 
written  in  new  languages  we  define  (PEDL  and  MEDL  respectively)  are  then  used  to  produce  other  components 
that  extract  low-level  information  from  the  program,  convert  it  to  events  and  check  that  the  sequence  of  events 
represents  correct  behavior.  We  have  successfully  tested  our  prototype  on  two  applications  —  micro  air  vehicles 
attaining  a  desired  formation,  and  convergence  of  a  network  routing  protocol. 

We  have  done  performance  measurements  on  JavaMAC  in  an  attempt  to  breakdown  the  overhead 
introduced  by  JavaMAC  into  its  various  components.  Subsequently  we  have  introduced  .several  optimizations  in 
JavaMAC  to  improve  the  performance. 
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